01The challenge
Thousands of alerts a day, stitched together by hand.
The SOC received thousands of alerts daily from the SIEM, threat-intel feeds and cloud security tools. Analysts enriched alerts, raised Jira tickets and coordinated in Slack by hand, across five security domains.
Incident response bottlenecksManual triage delayed containment on critical payment infrastructure.
Compliance remediation gapsCSPM findings became tickets and follow-ups, and stayed open.
Access changes by handOnboarding and offboarding across systems caused delays and oversights.
Exposure left openAttack-surface findings needed constant manual follow-up to close.
02The approach
One orchestration layer across the stack they already had.
autobotAI connected AWS, the SIEM, MISP, Jira, Slack and CSPM tools, augmenting the stack rather than replacing it. Razorpay built 30+ workflows, starting with incident response and compliance, each tested in non-production and deployed with approval gates.
Fig. 1One CSPM finding, eight systems
CSPMViolation foundagent
MISPThreat lookupagent
AWSResource checkagent
JiraTicket raisedagent
SlackOwner approvesperson approves
AWSFix appliedagent
SIEMChange loggedagent
JiraTicket closedagent
Days
eight handoffs, each waiting on a person, a queue or a meeting
eight handoffs, each waiting on a person, a queue or a meeting
Hours
agents carry every hop; one approval in Slack, fully logged
agents carry every hop; one approval in Slack, fully logged
Four of the workflows they built
Incident responseSOC
SIEM alertMISP enrichAWS contextSeveritySlack if critical
Compliance remediationGRC
CSPM violationJira for reviewSlack approvalApproved fix in AWSTicket updated
User lifecycleIGA
Jira joiner / leaverProvision or revokeRole checkAudit details in Jira
Attack-surface remediationExposure
Exposure foundJira + MISP contextOwner assignedSLA trackedEscalate in Slack
03The results
Faster response, with oversight intact.
73% lower MTTRIncidents that took hours now resolve in minutes.
Compliance in hoursCSPM violations fixed within hours instead of days.
Clean user lifecycleProvisioning and deprovisioning automated. No orphaned accounts.
Exposures closed on SLAEvery exposure has an owner, an SLA and automatic escalation.
Better collaborationSecurity, IT and engineering coordinate in Slack with oversight preserved.
Full visibilityLeadership sees response times, approvals and workload in one place.
“With increased exposure and tool sprawl, leaders must ensure disciplined and efficient response mechanisms. autobotAI allowed us to streamline and automate our runbooks: faster detection, quicker remediation and stronger operational outcomes.”
Ashwath KumarHead of Security, Razorpay